CVE-2026-97561

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

When the administrator mounts with forceuid or forcegid (uid=/gid=

mount options), they expect all files to appear owned by the specified

user/group. However, several code paths unconditionally called

sid_to_id() to overwrite cf_uid/cf_gid with server-provided values,

ignoring the administrator's explicit override:

- smb311_posix_info_to_fattr() (stat via POSIX extensions)

- cifs_posix_to_fattr() (readdir via POSIX extensions)

- parse_sec_desc() (CIFS ACL ownership mapping)

This allowed an untrusted server to dictate local file ownership even

when the mount was configured to force specific uid/gid values.

Fix all three call sites to check CIFS_MOUNT_OVERR_UID and

CIFS_MOUNT_OVERR_GID before calling sid_to_id(), following the

same pattern already used by cifs_unix_basic_to_fattr() for unix

extensions.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References